CVE-2024-22075

Firefly III before 6.1.1 allows HTML Injection via webhooks due to improper sanitization in webhook handling. Affected product: Firefly III (web application). Root cause: inadequate sanitization of webhook inputs leading to HTML injection. Impact: potential exposure/impact limited to confidential...

CVE-2021-3921

CVE-2021-3921 affects firefly-iii. Multiple sources document a Cross-Site Request Forgery (CSRF) vulnerability in firefly-iii that can cause a logged-in user to be logged out via a forged request example (via a GET/ANY login-logout flow). The Huntr entry specifically describes an attacker logging...

CVE-2021-4005

CVE-2021-4005 affects the Firefly-III project and is a Cross-Site Request Forgery (CSRF) vulnerability. Multiple connected records (OSV, GHSA, Red Hat, CNVD, CNVD-CNVD, CNVD-202112-206) describe firefly-iii as vulnerable to CSRF; OSV notes that the CSRF could disable two-factor authentication for...

CVE-2021-3851

CVE-2021-3851 affects firefly-iii (open-source personal finance app). Connected sources describe an Open Redirect vulnerability in the web application, enabling redirection to untrusted sites during a user flow (notably the bills/store flow where aReferer-based redirect can be manipulated to forw...

CVE-2023-0298

CVE-2023-0298 affects the Firefly III project in the GitHub repository firefly-iii/firefly-iii, with an vulnerability described as “Incorrect Authorization” in versions prior to 5.8.0. The connected documents consistently identify this as an authorization issue in the API path and confirm the aff...

CVE-2021-3819

CVE-2021-3819 is a Cross-Site Request Forgery (CSRF) vulnerability affecting firefly-iii. The NVD/OSV entries indicate high impact (CVSSv3.1 base score 8.8) with network access, no authentication, and user interaction required, enabling unauthorized requests to the server. The issue is acknowledg...

CVE-2019-13644

Firefly III prior to 4.7.17.1 is vulnerable to a stored XSS flaw in budget names due to insufficient filtering of user input. The JavaScript payload is stored inside a transaction and executed on the tags/show/$tag_number$ page. The vulnerability requires the attacker to have the same access righ...

CVE-2023-1788

CVE-2023-1788 affects Firefly III (firefly-iii/firefly-iii) prior to version 6.0.0, where sessions do not expire promptly after inactivity or on close. The issue is described as insufficient session expiration and is reflected in multiple sources (Red Hat advisory, GitHub advisory, GHSA, OSV, NVD...

CVE-2019-13646

CVE-2019-13646 affects Firefly III prior to 4.7.17.3 with a reflected XSS vulnerability in the search query due to lack of filtration of user-supplied data. Affected product: Firefly III (open-source personal finance manager); root cause: insufficient input filtering in search; impact: potential ...

CVE-2021-4015

CVE-2021-4015 affects the Firefly-III application and is a Cross-Site Request Forgery (CSRF) vulnerability. Multiple connected sources corroborate CSRF as the issue, with details pointing to an exploit path such as "/transactions/link/switch/id" (CNNVD summary). The CVE entry includes a CVSS v3.1...

CVE-2019-13647

Firefly III prior to 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file content. The JavaScript executes when viewing attachments/view/$file_id$, and an attacker must have the same access rights as the user to exploit. Affected software: Firefly III...

CVE-2019-13645

Firefly III prior to 4.7.17.3 is vulnerable to stored XSS due to lack of filtration of user-supplied data in image file names. The JavaScript executes during attachments/edit/$file_id$ attachment editing. An attacker must have the same access rights as the user to exploit. A fix is available: upd...

CVE-2021-3846

Firefly-III is reported vulnerable to Unrestricted Upload of File with Dangerous Type. The connected documents identify Firefly-III and an unrestricted upload issue but do not provide concrete technical details (vulnerable component/version, root cause, exploit specifics, or a fixed version) with...

CVE-2023-1789

CVE-2023-1789 affects firefly-iii/firefly-iii prior to 6.0.0. The root cause is improper input validation in the GitHub repository, leading to potential manipulation or disclosure paths. Public sources assign a high-severity impact (NVD CVSS 3.1 base score 9.8: Critical for confidentiality, integ...